Package Details

Package Details

The application consists of the following components:

1. Dashboard Packages
   
   • LP_McAfee Antivirus Overview 
   • LP_McAfee Antivirus Activity
2. Normalization Packages
   
   • LP_McAfee EPO Antivirus DB Generic 
   • LP_McAfee EPO XML 
   • LP_McAfee EPO Antivirus 
   • LP_McAfee EPO Antivirus DB 
   • LP_McAfee VSE 
3. Label Package
   • LP_McAfee EPO Antivirus DB 

Enhancement

A minor update has been done in the application’s normalizer for better signature handling. 

Installation 

Follow these steps to install the McAfee EPO v3.2.0 plugin:

Case I: Syslog Collector

1. Download the McAfee EPO package from the Download section above.
2. Add McAfee EPO as the required device in LogPoint.
3. Create a collection policy with the Syslog collector and appropriate processing policy. 
4. Assign the policy to the device.
5. Add the dashboard.

Case II: ODBC Fetcher

1. Download the Trend Micro DB package from the Download section above.
2. Add McAfee EPO as the required device in LogPoint.
3. Configure ODBC fetcher with the details listed in the Configuration of Sources section.
4. Assign the policy to the device.
5. Add the dashboard.

Screenshots

Supported Device

The supported device of McAfee EPO with LogPoint in this configuration is:

• McAfee EPO

Log Formats

McAfee EPO (Syslog Collector)

Expected Log Format

CEF

Log Sample

<9>CEF:0|McAfee EPO|VirusScan Enterprise|8.8|1092|Solidcore<Test Send threat events to Syslog Server> alert|2|alertId=1092 alertName=Test Send threat events to Syslog Server alertType='File' class or access eventType=SolidcoreEvent host=LOGPOINT eventname=Anti-virus Standard Protection:Prevent remote creation of autorun files workflowid= eventTimestamp=06/03/13 08:38:36 UTC eventObject=H:\PROJECTS\ISFDY\BD DEFENSE\SALES\PROPOSALS\COUNTRY\EDGYPT\EGYPT FAC-M\OBSOLETE\RWM - MASS(TM) (D)\AUTORUN.INF eventProgramName= eventProgramUser=SYSTEM

McAfee EPO (ODBC  Fetcher)

Expected Log Format

Semicolon-separated

Log Sample

"36172608";"2014-10-21 06:55:39.963000";"none";"none";"1119";"ops.update.end";"4";"2014-10-21 06:00:24";"None";"AutoUpdate";"none";"True";"SYSTEM";"jria";"DCCAT";"DC014134";"DC014134";"DC014134.DCCAT.DK";"10.11.0.82";"";"001f1639e203";"Windows 8.1";"Service Pack 1";"6.1";"7601";"Rom, normaltid";"None";"10.11.0.68";"None";"None";"None";"None";"1";"VirusScan Enterprise";"8.8";"5600.1067";"5600.1067";"7597.0000";"N/A";"5600.1067";"2";"8.8.0.975.Wrk";"";

Configuration of McAfee EPO (ODBC Fetcher)

• Driver: MSSQL2
• Port: 1433
• Database: Mcafee Database
• Username: 
• Password:
• Incremental Key: A unique key used as a pointer to read data from the table. The default value is AutoID.
• Incremental Key Table: Table to which the incremental key belongs to. The default value is EPOEvents.
• New Line Separator: Used for cases that have newline characters embedded in the log entries. In other cases, this can be discarded. 
• Query: This is used to fetch data from the table(s). The query may be simple or based on joins. The default query is:

SELECT [EPOEvents].[AutoID], [EPOEvents].[ReceivedUTC] as [timestamp], [EPOEvents].[ThreatName] as [signature], [EPOEvents].[ThreatType] as [threat_type], [EPOEvents].[ThreatEventID] as [signature_id], [EPOEvents].[ThreatCategory] as [category], [EPOEvents].[ThreatSeverity] as [severity_id], [EPOEvents].[DetectedUTC] as [detected_timestamp], [EPOEvents].[TargetFileName] as [file_name], [EPOEvents].[AnalyzerDetectionMethod] as [detection_method], [EPOEvents].[ThreatActionTaken] as [vendor_action], [EPOEvents].[ThreatHandled] as [threat_handled], [EPOEvents].[TargetUserName] as [target_user], [EPOComputerProperties].[UserName] as [user], [EPOComputerProperties].[DomainName] as [dest_nt_domain], [EPOEvents].[TargetHostName] as [dest_dns], [EPOEvents].[TargetHostName] as [dest_nt_host], [EPOComputerProperties].[IPHostName] as [fqdn], [dest_ip] = ( convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerProperties].[IPV4x] + 2147483648))),1,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerProperties].[IPV4x] + 2147483648))),2,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerProperties].[IPV4x] + 2147483648))),3,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOComputerProperties].[IPV4x] + 2147483648))),4,1))) ), [EPOComputerProperties].[SubnetMask] as [dest_netmask], [EPOComputerProperties].[NetAddress] as [dest_mac], [EPOComputerProperties].[OSType] as [os], [EPOComputerProperties].[OSServicePackVer] as [sp], [EPOComputerProperties].[OSVersion] as [os_version], [EPOComputerProperties].[OSBuildNum] as [os_build], [EPOComputerProperties].[TimeZone] as [timezone], [EPOEvents].[SourceHostName] as [src_dns], [src_ip] = ( convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),1,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),2,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),3,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([EPOEvents].[SourceIPV4] + 2147483648))),4,1))) ), [EPOEvents].[SourceMAC] as [src_mac], [EPOEvents].[SourceProcessName] as [process], [EPOEvents].[SourceURL] as [url], [EPOEvents].[SourceUserName] as [caller_user], [EPOComputerProperties].[IsPortable] as [is_laptop], [EPOEvents].[AnalyzerName] as [product], [EPOEvents].[AnalyzerVersion] as [product_version], [EPOEvents].[AnalyzerEngineVersion] as [engine_version], [EPOEvents].[AnalyzerEngineVersion] as [dat_version], [EPOProdPropsView_VIRUSCAN].[datver] as [vse_dat_version], [EPOProdPropsView_VIRUSCAN].[enginever64] as [vse_engine64_version], [EPOProdPropsView_VIRUSCAN].[enginever] as [vse_engine_version], [EPOProdPropsView_VIRUSCAN].[hotfix] as [vse_hotfix], [EPOProdPropsView_VIRUSCAN].[productversion] as [vse_product_version], [EPOProdPropsView_VIRUSCAN].[servicepack] as [vse_sp] FROM [EPOEvents] left join [EPOLeafNode] on [EPOEvents].[AgentGUID] = [EPOLeafNode].[AgentGUID] left join [EPOProdPropsView_VIRUSCAN] on [EPOLeafNode].[AutoID] = [EPOProdPropsView_VIRUSCAN].[LeafNodeID] left join [EPOComputerProperties] on [EPOLeafNode].[AutoID] = [EPOComputerProperties].[ParentID]